snort & pppoe

["Jo" <jo () cortical de>]

hi,

i use snort2.0.2, barnyard & acid on the following machine

extern----pppoe-eth0-ROUTER-eth1----intern

i run snort for tests on all 3 interfaces.

eth0 & ppp0 detect the same alerts.
-is eth0 decoding the pppoe packets?

eth0 & ppp0 doesnt work for payload logging.
-why can they detect payload signatures but log them?

i wrote some pass rules to ignore some traffic.
-is it possible config a var for the dynamic pppoe ip?

thx for help
jo


-------------------------------------------------------
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users